build(deps-dev): upgrade vitest to v5

[claude]

Requested by David Sanders · Slack thread

This bumps vitest from ^4.1.11 to ^5.0.1 and @vitest/coverage-v8 from 4.1.1 to 5.0.1. The coverage plugin requires the exact same vitest version, and the old pin had drifted from the locked vitest 4.1.11, which caused a "mixed versions" warning; that warning is now gone. Vitest 5 no longer depends on vite and instead lists it as a required peer dependency, so vite is added as a devDependency at ^8.0.16, the version already in the lockfile. The minimum @types/node version is also raised from ^22.9.0 to ^22.12.0 (now resolving to 22.20.3), because the locked 22.9.0 did not satisfy the @types/node peer range that vite and vitest require, and yarn warned about it on install. No test or config changes were needed: lint, build and all 123 tests pass, and coverage reports on the same files as before.

🤖 Generated with Claude Code

https://claude.ai/code/session_01N2vvE5XzurMvQfsX7Vz7bF

---

Generated by Claude Code

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​vitest/​coverage-v8@​4.1.1 ⏵ 5.0.1			+1
	vitest@​4.1.11 ⏵ 5.0.1	+1		+1
	@​types/​node@​22.9.0 ⏵ 22.20.3	+1		+1
	vite@​8.0.16

View full report

[claude]

Looks good, straightforward dependency bump.

What was reviewed: the package.json diff (vitest ^4.1.11→^5.0.1, @ vitest/coverage-v8 4.1.1→5.0.1, @ types/node ^22.9.0→^22.12.0, new vite ^8.0.16 devDependency) and confirmed yarn.lock is a mechanical regeneration with no other source changes; checked CODEOWNERS (generic fallback, no special ownership concern) and confirmed no application source files are touched.

Extended reasoning...

The change is confined to package.json and yarn.lock: a devDependency-only version bump (vitest v4→v5, matching coverage-v8, an added vite peer dependency, and a raised @ types/node floor) with no application source touched and no security-sensitive surface. CODEOWNERS is just the generic wg-upgrades/wg-ecosystem fallback, no specific human owner flagged. One candidate issue (future drift between the exact-pinned coverage-v8 and caret-ranged vitest) was already investigated and ruled out per the harness notes. The diff is small, mechanical, and easily verifiable by inspection, so no human look is required.